Detecting Execution Of Windows Security Audit Policy Auditpolexe
Query
DeviceProcessEvents
| where AccountName !has "system" and FileName has "auditpol.exe"
| summarize by Timestamp,DeviceName,DeviceId,FileName,AccountDomain,InitiatingProcessAccountName,AccountName, ProcessCommandLine, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1562.002 | Impair Defenses: Disable Windows Event Logging |
Author: Sergio Albea (29/10/2025)
Detecting Execution of Windows Security Audit Policy (Auditpol.exe)
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware
Explanation
This query is designed to detect potentially malicious activity related to the execution of the auditpol.exe command, which is used to modify Windows security audit policies. Here's a simple breakdown of what the query does:
-
Data Source: It analyzes events from
DeviceProcessEvents, which logs process-related activities on devices. -
Filtering Criteria:
- It excludes any processes run by the "system" account, focusing on those initiated by other accounts.
- It specifically looks for processes where the file name includes "auditpol.exe", indicating the execution of the audit policy command.
-
Output:
- The query summarizes the results by several fields, including the timestamp of the event, device name and ID, file name, account domain, the name of the account that initiated the process, the account name, the command line used to execute the process, and a report ID.
Overall, this query helps in identifying instances where auditpol.exe is executed by non-system accounts, which could be an indication of an attempt to disable or alter security logging as part of an attack, such as ransomware.
